The denominator is doing more work here than the 700. Shodan's catalog of 1,500 internet-facing Gogs instances is what one scanner could see [2], not a census of installations, and Wiz's 700 is a count of servers that still carried a particular piece of litter: a repository whose owner and name were each eight randomized alphanumeric characters, all created in a short window [7]. A short Python script matched that precise pattern across the exposed set [8]. Call it about 47 percent of the cataloged instances [1], and then notice what the number is sensitive to.
It is sensitive to the attacker's housekeeping. Yaara Shriki of Wiz made the point herself: this actor could have deleted the repositories it created and did not, which is part of why she reads it as aggressive rather than state-run [14]. A tidier operator using the same bug would leave the same servers compromised and this census near zero. The 800 cataloged instances without the signature [3] have not been shown to be clean, only that they do not carry this one campaign's fingerprint.
Depth and breadth also come apart. Wiz closely analyzed exactly one machine, its own customer's, and says it does not know what the attacker did on the rest [12], which leaves 699 servers observed only through a signature [4]. What the 700 does not tell you is whether any repository was actually pulled off any of them. The capability is not in question: the flaw yields full server control, access to hosted code, and a usable mining host [3]. The evidence of what was done in bulk is a shared command-and-control address, a shared set of SSH commands and one malware hash [10], resolving in every case to SuperShell, an off-the-shelf Python framework that plants a reverse SSH shell [11]. Wiz's read of the actor is opportunistic and financially motivated, possibly staging for ransomware or cryptomining [13].
That leaves operators one lever, because the other one does not exist. CVE-2025-8110 is unpatched and sits in the current release, published June 9 [1], and Wiz found the attack path bypasses two earlier mitigations, one of them for a path traversal flaw in the PutContents API [16]. Reachability, not version discipline, is the defense operators actually have.
The timeline is the part worth keeping. The earliest compromise Wiz could date was July 10, five days before a Yara rule fired on its customer's server on July 15 [9][2], and malware researcher Gili Tikochinski could not tie that infection to any known vector or vulnerability at the time [5]. Details of the flaw reached the public five seconds before the Black Hat Europe briefing in London began [4]. The only signal available in between was an unexplained infection on software the responders had never heard of, traced through an exposed web API and a suspicious symlink [6]. Shriki's methodological takeaway generalizes better than the CVE does: a pattern improbable enough to be unique is usable as a behavioral indicator of compromise [15]. If you expose Gogs, compromise is the defensible assumption, and a clean search for eight-character owner and repository pairs lowers your odds of having met this particular attacker without saying much about the flaw itself.
